Identity and access for system deployments in Scotland
Give the right people the right access from day one
A new system changes who can sign in, what they can see and what they can do. Stratiis helps organisations plan identity, permissions and access processes alongside the deployment, so users can work securely and support teams can maintain control after launch.
What is identity and access planning for a new system?
It is the work of defining user accounts, sign-in methods, roles, permissions, approvals and account changes before a system goes live. The plan should cover employees, contractors and administrators, then explain how access is granted, reviewed and removed throughout the system's life.
Why it matters
Make access useful, controlled and supportable
Clear access rules reduce delays for users and avoid leaving privileges in place after responsibilities change.
Ready to work
People receive the access their role needs at launch.
Fewer shared accounts
Named accounts make ownership and support clearer.
Defined approvals
Managers and system owners know who authorises changes.
Cleaner handover
Support teams have a repeatable way to maintain access.
Access design
What should an identity and access plan include?
The detail depends on the system and the sensitivity of its information. These decisions should be made before users are invited in.
| Area | Decision to make | Useful output |
|---|---|---|
| Users and roles | Who needs the system and which tasks each group performs? | Role and permission matrix. |
| Sign-in | Will accounts use an existing identity service, single sign-on or a separate login? | Agreed authentication design. |
| Multi-factor authentication | Where is MFA required and how will users enrol or recover access? | MFA and recovery procedure. |
| Approvals | Who requests, approves and records new or changed access? | Access request workflow. |
| Privileged access | Who administers the system and how will elevated rights be limited? | Admin account and escalation plan. |
| Joiners, movers and leavers | How will access be granted, changed and removed as roles change? | Lifecycle checklist with owners. |
| Review and evidence | How will permissions and unusual activity be checked? | Review schedule and audit responsibilities. |
System owners should approve the rules; IT and suppliers can then confirm which controls the platform can actually support.
What to review
Check the points where access commonly goes wrong
A good design covers routine use and the exceptions that appear during rollout.
Account ownership
Use named accounts where possible and document any service or shared accounts that remain.
Role permissions
Give each group the access it needs, including any separation between review, approval and administration.
Sign-in and MFA
Plan single sign-on, MFA, recovery and support for users who cannot complete a normal sign-in.
External access
Agree how contractors, partners and suppliers receive limited access and when it expires.
Data visibility
Test what each role can view, edit, export or delete, including connected records.
Access changes
Make joiner, mover and leaver steps part of the ongoing support process.
How support starts
From access requirements to a tested handover
Identity decisions need both business ownership and technical validation.
Discover
Identify users, information, tasks, systems and existing sign-in methods.
Design
Agree roles, approvals, MFA, administrator access and account lifecycle.
Test
Check real user journeys, denied access, recovery and exceptional cases.
Handover
Document owners, support steps, reviews and outstanding risks.
New System Deployments brings this access work together with configuration, data, training and launch.
People and ownership
Agree who makes the access decisions
The system owner defines business rules. Managers approve access for their people. Technical teams set up and support the agreed controls.
Before launch
Confirm the system owner, each user role, approval route and who can change permissions. Decide how external and privileged accounts will be handled.
After launch
Keep account changes, periodic reviews and emergency access within a documented service process. Record who resolves access incidents and who signs off material changes.
IT Project Management can coordinate decisions and handover across the business and its suppliers.
Testing access
How do you know permissions are ready for launch?
Test with representative users and roles, including actions they should not be able to perform.
| Test | What it confirms |
|---|---|
| Normal sign-in | Each role can enter the system with the agreed sign-in method. |
| MFA and recovery | Users can enrol and recover access through an approved support route. |
| Role boundaries | Users can complete their tasks without viewing or changing unrelated information. |
| Approval changes | Requests, elevated rights and role changes follow the agreed authority. |
| Leaver removal | Access can be disabled promptly and connected permissions are considered. |
| Audit and support | Owners can review permissions and support staff can diagnose access issues. |
Record failed tests and workarounds before rollout. The supplier and system owner should agree how each issue will be resolved.
Lifecycle and review
Keep access accurate as people and roles change
Access control continues after deployment. A named owner should review rights and remove those no longer needed.
Joiners
Set up the right account and role when work begins.
Movers
Change permissions when duties or teams change.
Leavers
Remove access and check connected systems and devices.
Reviews
Confirm that roles and administrator rights still match need.
Where mobile devices are part of the workflow, Mobile Device Management can support device control alongside account decisions.
Related Stratiis services
Connect access design to the wider project
Identity decisions affect system configuration, security, user experience and support.
New System Deployments
Coordinate the full deployment and handover.
Cybersecurity Services
Review security controls and risk around identities.
Microsoft 365 Services
Plan access to the Microsoft workplace environment.
Technology Roadmaps
Prioritise identity improvements across systems.
Frequently asked questions
Identity and access for new systems explained
What is identity and access management?
It is the set of processes and controls used to identify users, verify sign-in and decide what each person can do in a system. It also covers how access is changed and removed.
Should a new system use single sign-on?
Single sign-on can simplify access and centralise some controls when the system supports it. The decision depends on integration, licensing, security requirements and support arrangements.
Why use multi-factor authentication?
MFA adds a second check at sign-in and helps reduce the risk from a compromised password. Plan enrolment, recovery and exceptions before launch.
Who approves user permissions?
The business or system owner should define roles and an appropriate manager should approve access. IT or the supplier then applies the agreed permission, with responsibilities documented.
What is least-privilege access?
It means giving a user only the permissions needed for their work and reviewing those rights as duties change. Administrator rights should be handled separately.
How should contractor access be handled?
Use a named owner, defined purpose, appropriate role and an end date or review point. Remove access when the engagement ends.
What happens when an employee leaves?
Follow a documented leaver process to disable accounts and review linked applications, administrator rights, sessions and devices as appropriate.
Can Stratiis work with our software supplier?
Yes. Stratiis can help coordinate identity requirements, technical dependencies, testing and handover with the supplier. Product-specific configuration responsibilities should be agreed for the project.
Discuss your system deployment
Make access straightforward for users and accountable for owners
Tell us which system you are introducing and where sign-in, permissions or account changes need a clearer plan.
